Debian Package Tracker

general

source: poppler (main)
version: 20.09.0-3
maintainer: Debian freedesktop.org maintainers (archive) (DMD)
uploaders: Loic Minier [DMD] – Emilio Pozuelo Monfort [DMD] – Pino Toscano [DMD]
arch: all any
std-ver: 4.1.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 0.26.5-2+deb8u4
o-o-sec: 0.26.5-2+deb8u13
oldstable: 0.48.0-2+deb9u2
old-sec: 0.48.0-2+deb9u4
stable: 0.71.0-5
testing: 20.09.0-3
unstable: 20.09.0-3

versioned links

0.26.5-2+deb8u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.26.5-2+deb8u13: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.48.0-2+deb9u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.48.0-2+deb9u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.71.0-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.71.0-6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.85.0-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
20.09.0-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

gir1.2-poppler-0.18
libpoppler-cpp-dev
libpoppler-cpp0v5
libpoppler-dev
libpoppler-glib-dev
libpoppler-glib-doc
libpoppler-glib8 (3 bugs: 1, 2, 0, 0)
libpoppler-private-dev (1 bugs: 0, 0, 1, 0)
libpoppler-qt5-1
libpoppler-qt5-dev
libpoppler102
poppler-utils (48 bugs: 0, 30, 18, 0)

action needed

A new upstream version is available: 21.01.0 high

A new upstream version 21.01.0 is available, you should consider packaging it.

Created: 2020-10-05 Last update: 2021-01-20 22:37

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2019-9543: An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit.
CVE-2019-9545: An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JBIG2Bitmap::clearToZero.

Please fix them.

Created: 2018-05-10 Last update: 2020-12-30 03:54

2 security issues in bullseye high

There are 2 open security issues in bullseye.

2 important issues:

CVE-2019-9543: An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit.
CVE-2019-9545: An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JBIG2Bitmap::clearToZero.

Please fix them.

Created: 2019-07-07 Last update: 2020-12-30 03:54

18 bugs tagged patch in the BTS normal

The BTS contains patches fixing 18 bugs (19 if counting merged bugs), consider including or untagging them.

Created: 2020-10-19 Last update: 2021-01-21 04:02

2 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 05f5f5c1f0af6440556a74ae59a81e0dfcbf6489
Author: John Scott <jscott@posteo.net>
Date:   Mon Jul 13 17:42:14 2020 -0400

    Update debian/watch to version 4 and enable signature checking.

commit cd2d816b4a7769e64687730955d6717b2fe173be
Author: Gianfranco Costamagna <costamagnagianfranco@yahoo.it>
Date:   Thu Nov 5 11:58:01 2020 +0100

    poppler: add some optional symbols that appears/disappears when the source is built with -O3

Created: 2020-12-11 Last update: 2021-01-20 02:34

lintian reports 3 warnings normal

Lintian reports 3 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2020-09-21 Last update: 2020-09-21 06:03

Multiarch hinter reports 1 issue(s) low

There are issues with the multiarch metadata for this package.

libpoppler-glib-doc could be marked Multi-Arch: foreign

Created: 2017-12-07 Last update: 2021-01-21 04:05

11 ignored security issues in stretch low

There are 11 open security issues in stretch.

11 issues skipped by the security teams:

CVE-2017-14617: In Poppler 0.59.0, a floating point exception occurs in the ImageStream class in Stream.cc, which may lead to a potential attack when handling malicious PDF files.
CVE-2018-13988: Poppler through 0.62 contains an out of bounds read vulnerability due to an incorrect memory access that is not mapped in its memory space, as demonstrated by pdfunite. This can result in memory corruption and denial of service. This may be exploitable when a victim opens a specially crafted PDF file.
CVE-2018-18897: An issue was discovered in Poppler 0.71.0. There is a memory leak in GfxColorSpace::setDisplayProfile in GfxState.cc, as demonstrated by pdftocairo.
CVE-2018-20551: A reachable Object::getString assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to construction of invalid rich media annotation assets in the AnnotRichMedia class in Annot.c.
CVE-2019-10871: An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc.
CVE-2019-10873: An issue was discovered in Poppler 0.74.0. There is a NULL pointer dereference in the function SplashClip::clipAALine at splash/SplashClip.cc.
CVE-2019-11026: FontInfoScanner::scanFonts in FontInfo.cc in Poppler 0.75.0 has infinite recursion, leading to a call to the error function in Error.cc.
CVE-2019-9543: An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit.
CVE-2019-9545: An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JBIG2Bitmap::clearToZero.
CVE-2019-9903: PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located at Dict.cc, which can (for example) be triggered by passing a crafted pdf file to the pdfunite binary.
CVE-2020-27778: A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by the 'pdftohtml' program, would crash the application causing a denial of service.

Please fix them.

Created: 2017-06-03 Last update: 2020-12-30 03:54

11 ignored security issues in buster low

There are 11 open security issues in buster.

11 issues skipped by the security teams:

CVE-2018-18897: An issue was discovered in Poppler 0.71.0. There is a memory leak in GfxColorSpace::setDisplayProfile in GfxState.cc, as demonstrated by pdftocairo.
CVE-2018-19058: An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file.
CVE-2018-20650: A reachable Object::dictLookup assertion in Poppler 0.72.0 allows attackers to cause a denial of service due to the lack of a check for the dict data type, as demonstrated by use of the FileSpec class (in FileSpec.cc) in pdfdetach.
CVE-2019-10871: An issue was discovered in Poppler 0.74.0. There is a heap-based buffer over-read in the function PSOutputDev::checkPageSlice at PSOutputDev.cc.
CVE-2019-11026: FontInfoScanner::scanFonts in FontInfo.cc in Poppler 0.75.0 has infinite recursion, leading to a call to the error function in Error.cc.
CVE-2019-14494: An issue was discovered in Poppler through 0.78.0. There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at SplashOutputDev.cc.
CVE-2019-9543: An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readGenericBitmap() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfseparate binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JArithmeticDecoder::decodeBit.
CVE-2019-9545: An issue was discovered in Poppler 0.74.0. A recursive function call, in JBIG2Stream::readTextRegion() located in JBIG2Stream.cc, can be triggered by sending a crafted pdf file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. This is related to JBIG2Bitmap::clearToZero.
CVE-2019-9903: PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict marking, leading to stack consumption in the function Dict::find() located at Dict.cc, which can (for example) be triggered by passing a crafted pdf file to the pdfunite binary.
CVE-2019-9959: The JPXStream::init function in Poppler 0.78.0 and earlier doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making it possible to allocate a large memory chunk on the heap, with a size controlled by an attacker, as demonstrated by pdftocairo.
CVE-2020-27778: A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when processed by the 'pdftohtml' program, would crash the application causing a denial of service.

Please fix them.

Created: 2018-05-10 Last update: 2020-12-30 03:54

Build log checks report 2 warnings low

Build log checks report 2 warnings

Created: 2017-10-26 Last update: 2018-10-18 20:27

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.5.1 instead of 4.1.2).

Created: 2017-08-16 Last update: 2020-11-17 05:41

news

[rss feed]

[2020-11-08] Accepted poppler 0.48.0-2+deb9u4 (source) into oldstable (Markus Koschany)
[2020-11-07] poppler 20.09.0-3 MIGRATED to testing (Debian testing watch)
[2020-11-03] Accepted poppler 20.09.0-3 (source) into unstable (Emilio Pozuelo Monfort)
[2020-09-07] poppler 20.09.0-2 MIGRATED to testing (Debian testing watch)
[2020-09-03] Accepted poppler 20.09.0-2 (source) into unstable (Emilio Pozuelo Monfort)
[2020-09-03] Accepted poppler 20.09.0-1 (source) into unstable (Emilio Pozuelo Monfort)
[2020-09-02] Accepted poppler 20.08.0-1 (source amd64 all) into experimental, experimental (Debian FTP Masters) (signed by: Emilio Pozuelo Monfort)
[2020-08-20] poppler 0.85.0-2 MIGRATED to testing (Debian testing watch)
[2020-08-20] poppler 0.85.0-2 MIGRATED to testing (Debian testing watch)
[2020-08-18] Accepted poppler 0.85.0-2 (source) into unstable (Emilio Pozuelo Monfort)
[2020-07-23] Accepted poppler 0.48.0-2+deb9u3 (source) into oldstable (Emilio Pozuelo Monfort)
[2020-02-21] Accepted poppler 0.85.0-1 (source amd64 all) into experimental, experimental (Emilio Pozuelo Monfort)
[2019-10-18] Accepted poppler 0.26.5-2+deb8u13 (source amd64 all) into oldoldstable (Brian May)
[2019-10-17] Accepted poppler 0.26.5-2+deb8u12 (source amd64 all) into oldoldstable (Brian May)
[2019-10-12] Accepted poppler 0.81.0-1 (source amd64 all) into experimental, experimental (Emilio Pozuelo Monfort)
[2019-10-06] poppler 0.71.0-6 MIGRATED to testing (Debian testing watch)
[2019-10-04] Accepted poppler 0.71.0-6 (source) into unstable (Emilio Pozuelo Monfort)
[2019-09-30] Accepted poppler 0.26.5-2+deb8u11 (source amd64 all) into oldoldstable (Thorsten Alteholz)
[2019-06-06] Accepted poppler 0.26.5-2+deb8u10 (source amd64 all) into oldstable (Emilio Pozuelo Monfort)
[2019-05-30] poppler 0.71.0-5 MIGRATED to testing (Debian testing watch)
[2019-05-27] Accepted poppler 0.71.0-5 (source amd64 all) into unstable (Moritz Muehlenhoff) (signed by: Moritz Mühlenhoff)
[2019-05-27] Accepted poppler 0.71.0-4.1 (source amd64 all) into unstable (Jonathan Wiltshire)
[2019-05-26] poppler 0.71.0-4 MIGRATED to testing (Debian testing watch)
[2019-05-23] Accepted poppler 0.71.0-4 (source amd64 all) into unstable (Moritz Muehlenhoff) (signed by: Moritz Mühlenhoff)
[2019-04-08] Accepted poppler 0.26.5-2+deb8u9 (source amd64 all) into oldstable (Mike Gabriel)
[2019-03-08] Accepted poppler 0.26.5-2+deb8u8 (source amd64 all) into oldstable (Markus Koschany)
[2019-03-07] poppler 0.71.0-3 MIGRATED to testing (Debian testing watch)
[2019-03-02] Accepted poppler 0.71.0-3 (source) into unstable (Emilio Pozuelo Monfort)
[2019-01-10] poppler 0.71.0-2 MIGRATED to testing (Debian testing watch)
[2019-01-07] Accepted poppler 0.71.0-2 (source) into unstable (Emilio Pozuelo Monfort)

bugs [bug history graph]

all: 123 129
RC: 1
I&N: 87 92
M&W: 35 36
F&P: 0
patch: 18 19

links

homepage
lintian (0, 3)
buildd: logs, checks, clang, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 20.09.0-3ubuntu1
101 bugs (5 patches)
patches for 20.09.0-3ubuntu1